Editing A Gpo And Gpo Settings

By Author: fiona
Total Articles: 191
Comment this article

To edit a GPO or its settings, follow the CompTIA A+ certification outlined earlier in this lesson for creating a GPO and for specifying Group Policy settings.
Exercise 2: Testing a GPO
In this exercise, you view the effects of the GPO you implemented in Exercise 1.
1.Log on as Userl9, a member of the Marketing security group.
2.Press Ctrl+Alt+Del. The Windows Security dialog box appears. Are you able to lock the workstation? Why?
No, the Lock Computer option is not available. Userl9 is unable to lock the workstation because the West OU Desktop GPO applies to the Marketing security group, of which Userl9 is a member.
3.Click Cancel, and then click Start.Does the Search command appear on the Start menu?No.Does the Run command appear on the Start menu?No.
4.Log off as Userl9, then log on as Administrator.5.Remove Userl9 from the Marketing security group.6.Log off as Administrator, then log on as Userl9-
7.Press Ctrl+Alt+Del. Are you able to lock the workstation? Why?
Yes, the Lock Computer option is available. Userl9 is able to lock ...
... the workstation because the West OU Desktop GPO applies only to members of the Marketing security group, of which Userl9 is no longer a member.
8.Log off as Userl9, then log on as User?,
9.Press Ctrl+Alt+Del.
Are you able to lock the workstation? Why or why not?
Yes, because the Lock Computer option is available. User? is able to lock the workstation because the West OU Desktop GPO applies only to the Marketing security group, of which User? is not a member. This is true even though the West OU Desktop GPO is linked to the Chi?cago OU, in which User? is contained.
10.Log off as User?, then log on as practical application Administrator.
11.Make User? a member of the Marketing security group.
12.Log off as Administrator, then log on as User?.
13.Press Ctrl+Alt+Del.
Are you able to lock the workstation? Why or why not?
No, because the Lock Computer option is not available. User? is unable to lock the workstation because the West OU Desktop GPO is linked to the Chicago OU and applies only to the Marketing security group, of which User? is now a member.
14.Log off as User?, then log on as Administrator.
15.Create a new GPO in the Kansas City OU. Name the GPO KC OU Desktop. Create an MMC for the KC OU Desktop GPO. Name the console KC OU Desktop GPO.
16.In the User Configuration node, in the Administrative Templates node, in the Control Panel node, configure the Prohibit Access To The Control Panel setting to Enabled.
17.Set the Block Policy Inheritance option in the Group Policy tab in the Properties dialog box for the Kansas City OU to block GPOs set in parent objects from applying to the Kansas City OU.
18.For the KC OU Desktop GPO, set the Apply Group Policy permission for the Marketing domain local security group to Allow. Clear the Apply Group Policy per
mission (currently set to Allow) for the Authenticated Users group. Do not set this
permission to Deny.
19.Log off as Administrator, then log on as Userl?. Which GPO applies and why?
The West OU Desktop and the KC OU Desktop GPOs both apply to Userl? because the West OU Desktop GPO has the No Override option set. The No Override option ensures that none of a GPO's settings can be overridden by any other GPO during the processing of group policies. Even though the Block Policy Inheritance option is set for the KC OU Desktop GPO, the No Override option set for the West OU Desktop GPO overrides the KC OU Desktop GPO. Therefore, both GPOs apply to Userl?.
20.Log off as Userl?, then log on as User?. Which GPO applies and why?
Only the West comptia security Desktop GPO applies to User?. Because the KC OU Desktop GPO has not been linked to the Chicago OU (in which User? is contained) or the East OU (parent OU of the Chicago OU), the KC OU Desktop GPO does not apply to User?.